Russian APT29 Hackers Exploit Trusted Websites to Compromise Mobile Devices
Russian state-sponsored hackers are leveraging compromised legitimate and lookalike websites to deliver sophisticated exploits targeting older iOS and Android versions, aiming to steal sensitive user data.
A sophisticated campaign orchestrated by the Russian state-linked hacking group APT29, also known as Midnight Blizzard or Cozy Bear, is actively compromising trusted websites to serve malicious exploits to unsuspecting iPhone and Android users. Identified in October 2026, this "watering hole" attack strategy involves injecting malicious JavaScript into legitimate or cloned websites, which then attempts to exploit previously patched vulnerabilities on visitor devices. The primary objective appears to be the theft of sensitive data, including browser cookies, Wi-Fi passwords, and potentially broader device information.
The attackers employ a multi-pronged approach to achieve their goals. One method involves directly injecting malicious code into the website templates of compromised legitimate sites. Researchers have observed this tactic on sites belonging to a Ukrainian gas production company, a US chemical industry trade group, a European political party, and a Bulgarian military-related entity. In cases where direct compromise was not feasible, APT29 resorted to creating convincing lookalike domains, such as "america250[.]holiday" and "theowo[.]club," which mimicked legitimate sites like America250 and the Raffles London at The OWO hotel. These fake sites were likely intended to target diplomats and high-profile guests.
A particularly widespread vector involved compromising the Plerdy Ukrainian SEO tracker service. Between August 27 and September 3, 2026, attackers modified Plerdy's tracker file, causing thousands of websites that utilized the service to inadvertently load APT29's malicious script. This broad distribution method significantly increased the potential victim pool, with many affected sites linked to the military and defense sectors.
The core of the attack relies on a script named "UltimateFingerprinter," cleverly disguised within a large AngularJS library file to evade automated analysis. This script performs extensive device checks, collecting hundreds of data fields. Crucially, it then serves tailored exploits based on the detected device and operating system. The campaign specifically targets older versions of iOS and Android, including iOS 16.7 and specific Chrome versions on Android, exploiting chained vulnerabilities that have since been patched by vendors.
Sekoia, the cybersecurity firm that identified the campaign, detailed three distinct exploit chains. Chain A targets iOS 16.7, stealing cookies using CVE-2025-43529 and CVE-2024-27834. Chain B, the most potent, leverages the leaked DarkSword exploit kit against iOS 18.5, chaining multiple vulnerabilities (CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520) to exfiltrate messages, call history, passwords, photos, and iCloud Drive files. Chain C targets Android devices with specific Chrome versions, using CVE-2026-3910 and CVE-2025-27038 to steal cookies, saved logins, history, and Wi-Fi settings.
While the payloads do not establish persistent access, the stolen data, particularly session cookies, can allow APT29 to hijack active user sessions for webmail and other services, facilitating further intelligence gathering. The use of commercial surveillance exploits by state-sponsored groups is a growing trend, as observed in previous APT29 campaigns targeting Mongolian government websites and Amazon. The attackers' infrastructure, including domains like ad.starx-net[.]com, was used for data exfiltration.
To mitigate this threat, users are strongly advised to keep their operating systems and browsers updated to the latest versions. Devices that no longer receive security updates are particularly vulnerable and should be considered for replacement. Organizations should also review their logs for the identified indicators of compromise and audit the use of third-party scripts on their websites to prevent similar attacks.